Access Training
for Customers/Partners
Access Training
for NetWitness Employees
This is an Instructor Led Training class, for On-Demand/Self-Paced please click here
Summary
This training introduces security analysts and administrators to the architecture and toolkit for detecting and investigating risk on endpoint hosts.
This is an update to version 11.6.
Overview
This 2-day course consists of lecture/discussion and lab exercises intended for lay the foundations of your understanding of NetWitness Endpoint.
Intended audience is anyone performing security monitoring, hunting, and analysis with NetWitness Endpoint; anyone serving as admin or content creator for NetWitness Endpoint will also benefit. It supplements the NetWitness Platform Foundations and NetWitness Admin I courses.
Audience
Anyone new to NetWitness Endpoint interested in increasing their familiarity with the tool’s features and functions within the context of endpoint investigation and analysis.
Duration: 2 days
Prerequisite Knowledge/Skills
Basic familiarity with NetWitness Platform 11.x (recommended)
Familiarity with typical incident response processes (recommended)
Basic knowledge of malware, networking fundamentals and general security analysis concepts is recommended.
Course Objectives
Upon completion of this training, the student should be able to:
- Enable/Disable a data retention policy
- Define new Endpoint policy group
- Configure the NetWitness Endpoint Log Hybrid
- Create packager and deploy Endpoint agent
- Scan endpoint host and evaluate results
- Interpret host and file risk scores
- Customize Endpoint data display
- Analyze a process, including parent and child processes
- Identify potentially malicious activity
- Identify Autoruns on a Windows endpoint
- Create an incident manually
- Assign an incident in Respond
- Interpret incident views
- View deployed ESA rules for Endpoint
- Extract a Master File Table
- Identify timestamp discrepancies in MFT
- Download files for external analysis
Course Outline
Module 1: Introduction
Module 2: Architecture & Configuration
Module 3: Endpoint Agents, Hosts, & Scans
Module 4: Risk Scores and Metadata
Module 5: Files and Libraries
Module 6: Processes, Autoruns and Anomalies
Module 7: Alerts and Incidents
Module 8: Malicious Behavior & App Rules
Module 9: Forensic Tools
Module 10: Configuration
If you have any questions, please contact your account manager or Contact Us directly!
